Privacy Policy

Introduction

Use of the website of Weiz Technologies and/or its affiliated companies (hereinafter, collectively and individually: "Weiz", "WeizChat", the "Company", "we", "us" or "our") and of the WeizChat platform is subject to the provisions of this Privacy Policy, which forms an integral part of the Terms of Service.

The purpose of this Privacy Policy is to explain what personal information we collect in connection with the website (weiz.chat, weiz.co.il — the "Website") and the WeizChat platform available at app.weiz.chat (the "Platform"), how we use, retain, share and protect it, and what rights you have in relation to it, in accordance with applicable law in the State of Israel.

Any access to or use of the Website or the Platform constitutes confirmation that you have read this Privacy Policy, understood its contents and agreed to its terms. If you do not agree to this Policy, in whole or in part, you are requested to refrain from using the Website and the Platform.

For convenience of reading only, this Policy may be drafted in the masculine form, but it is intended for persons of all genders; the singular includes the plural and vice versa, as the context requires.

For any question or request regarding privacy, including exercising your rights, you may contact us through the Contact page or by email at chat@weiz.co.il.

What WeizChat Is, and the Two Roles We Act In

WeizChat is a software platform for managing business conversations on WhatsApp: a shared team inbox, an AI assistant, chatbot and automation tools, template-based campaigns and customer management. The Platform connects to the WhatsApp Business Platform (Cloud API) operated by Meta Platforms, Inc. ("Meta"). We are an independent software provider and are not affiliated with Meta.

We process personal information in two distinct roles:

• As a controller — for information about visitors to the Website, people who contact us, and the people who open and operate WeizChat accounts. This Policy describes that processing.
• As a processor on behalf of our business customers — for the conversations, contact details and related content of the customers of the businesses that use WeizChat. Each business is the controller of its own customers' data and instructs us to process it in order to provide the service, under this Policy. If you are a customer of a business that uses WeizChat, please direct privacy requests to that business; we will assist it in fulfilling them, as described on the data deletion page.

Information We Collect

Some of the information collected may constitute "personal information" as defined in the Protection of Privacy Law, 5741–1981. Depending on how you use the Website and the Platform, we may collect:

• Website inquiries — name, email address, telephone number, company name and the content of inquiries submitted through contact forms or other channels;
• Account information — name, email address, telephone number, workspace and business details, sign-in credentials (passwords are stored in hashed form only) and roles of team members;
• Platform content, processed for the business that controls it — WhatsApp conversations and media, customer records (such as phone number, profile name, tags and notes), catalog and business facts, AI and chatbot configuration, templates and campaign content;
• Usage and technical information — IP address, browser type, operating system, browsing times, pages visited, actions performed and similar log data, collected automatically for operation and security.

Information is collected directly from you (when you provide it) and automatically (through log files, essential cookies and similar technologies, as described in the Cookies section below).

Why We Process Information

We use personal information for the following purposes, and in accordance with applicable law:

• providing the Website, the Platform and the services you request, and managing accounts and workspaces;
• responding to inquiries and providing customer support;
• operating, maintaining, securing and improving the service, including detecting faults, preventing fraud and protecting the rights of the Company, its customers and third parties;
• sending operational and service messages relating to the service;
• sending marketing communications, subject to applicable law and any required consent, with the option to unsubscribe at any time;
• complying with legal obligations, court orders and instructions of competent authorities.

Where required by law, processing is based on your consent, on the performance of an agreement with you, on compliance with a legal obligation, or on the legitimate interests of the Company, provided such processing does not disproportionately infringe your rights.

We may also use aggregated, de-identified technical and statistical information, which does not identify any person, for analyzing and improving the service.

WhatsApp and the Cloud API

Messages sent and received through the Platform are routed through Meta's WhatsApp Business Platform (Cloud API). Meta processes such messages in accordance with its own terms and policies, including its data-retention practices for the Cloud API, which are outside the Company's control. Copies of conversations held on your own WhatsApp application, and data held independently by Meta, are outside WeizChat's systems.

Within WeizChat, conversation content is stored for the business that owns the conversation, so that its team can read, manage and answer it — which is the service itself.

AI Processing

Where a business enables the AI assistant, chatbot or related features, conversation content and the business's configured catalog and rules are processed to generate replies and summaries. For this purpose we use carefully selected third-party AI model providers (such as Anthropic) as sub-processors, bound by confidentiality and data-protection obligations; we do not use our customers' content to train models of our own.

Learning from past conversations. A business may also allow our AI setup assistant (Weizic) to read its past WhatsApp conversations, so that it can propose how the business writes, questions its customers often ask, example replies, rules and products. This is off until an administrator of the business turns it on, and it can be turned off at any time. Only conversations in which a member of the business's staff replied are read, within a period the business chooses (up to 12 months). Phone numbers, email addresses and links are removed before any text is sent to our AI model provider, and messages written by the AI, the chatbot or a campaign are not included. The results are proposals only: nothing is used until the business approves it, and a price seen in a past conversation is never used unless the business confirms it. When a person's information is erased, anything proposed from their conversations is deleted with it.

A business's own AI account. A business may instead connect its own account with a supported AI provider (currently Anthropic, OpenAI or Google) by entering its own key. The business can then choose to use that account for drafting replies and, where the provider supports it, for answering its customers. In that case the text needed for those features — including customers' messages — is sent to the provider the business chose, under the business's own agreement with that provider, and that provider acts on the business's behalf rather than as our sub-processor. If the business's own account cannot be reached, we do not send the text to our provider instead; the conversation is passed to a person on the business's team. The key is stored encrypted and is never shown again, not even to us. Our AI setup assistant, including learning from past conversations, always uses our own provider.

Each business controls these features: it can choose a draft-only mode in which a human approves every reply, pause the assistant, or take over any conversation with a human agent at any time.

Retention and Deletion

We retain personal information for as long as necessary for the purposes for which it was collected — as a rule, for as long as the relevant account is active — and thereafter as required to comply with law, resolve disputes and enforce agreements.

A business may delete individual customer records, conversations or its entire account, or request deletion by email; verified deletion requests are fulfilled within 30 days and confirmed in writing, as described on the data deletion page. Backups that include deleted data expire on their own fixed schedule and are not restored into live systems. Records that must be kept by law (for example, invoices) are retained only as long as the law requires.

Sharing and Disclosure

The Company does not sell, rent or trade personal information.

We may share personal information with third parties only in the following circumstances:

• Service providers and sub-processors that support the operation of the service — each named individually in the Sub-processors section below — solely to the extent necessary and subject to confidentiality and data-protection obligations;
• Legal requirements — where required by law, court order or the instruction of a competent authority;
• Protection of rights — to protect the rights, property or safety of the Company, its customers or the public, including preventing fraud and information-security incidents;
• Corporate events — in connection with a merger, acquisition, restructuring or transfer of operations, provided the receiving party remains bound by this Policy or an equivalent one;
• With your consent, where consent is required by law.

Sub-processors

We engage a small number of providers to operate the service. Each processes personal information only on our instructions and for the purpose stated below, and each is bound by confidentiality and data-protection obligations.

The backup storage provider is identified by name to an account owner, or to a controller under our Data Processing Addendum, on request. We will announce any intended addition or replacement of a sub-processor in advance, and account owners may object on reasonable grounds.

An AI provider that a business connects with its own key is not listed here: it is engaged by that business directly, under the business's own agreement.

International Transfers

Personal information may be stored or processed outside the State of Israel. The application, the database and uploaded media are hosted in Germany, within the European Union. Nightly off-site backup copies of the database and uploaded media are held with a cloud storage provider in the United States. Meta and our AI model provider process information on their own infrastructure, which is located principally in the United States. Where information is transferred to a country whose law does not provide a level of protection equivalent to Israeli law, the Company relies on a recognised transfer mechanism and takes appropriate safeguards, including contractual confidentiality and data-security obligations with its providers, as required by applicable law.

Security

The Company implements organizational, physical and technological measures appropriate to the nature and sensitivity of the information, in accordance with the Protection of Privacy Regulations (Data Security), 5777–2017, and applicable law — including encryption of credentials and sensitive keys, access controls limited to those who require the information for their duties, and ongoing review of its security measures.

No system provides absolute protection, and the Company cannot guarantee complete immunity from unauthorized access or security incidents. The Company will handle any such incident in accordance with its procedures and applicable law and will act to mitigate its impact.

Cookies

The Website uses essential cookies only — those required for its proper and secure operation and for remembering basic preferences. The Website currently operates no analytics or tracking tools; non-essential scripts are blocked unless and until a visitor gives consent through the consent banner, and if analytics are introduced in the future they will run only after such consent.

The Platform uses cookies required for signing in and securing sessions. You may manage or block cookies in your browser settings; blocking essential cookies may prevent parts of the service from functioning.

Your Rights

Under the Protection of Privacy Law, 5741–1981, you are entitled to request access to personal information about you held in the Company's databases, and to request the correction or deletion of information that is inaccurate or unlawfully processed. You may also request removal from marketing mailing lists at any time.

If you are in the European Economic Area or the United Kingdom, you may additionally have rights under the GDPR — including access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority.

If you are a customer of a business that uses WeizChat, the business is the controller of your data — please contact it directly; upon request we will forward your inquiry to the business and assist it in fulfilling your rights.

To exercise your rights, contact us at chat@weiz.co.il or through the Contact page. We will handle requests within a reasonable time and in accordance with applicable law.

Children

The Website and the Platform are intended for businesses and are not directed at minors under the age of 18. We do not knowingly collect personal information from minors; if you believe a minor has provided us personal information, please contact us and we will delete it.

Marketing Communications

We may send communications by email, SMS, WhatsApp or other electronic means, including professional updates and commercial offers, in accordance with applicable law and, where required, only after obtaining your consent. You may unsubscribe at any time using the link included in the messages or by contacting us. Unsubscribing does not prevent operational and service messages that are not marketing communications.

Third-Party Services and Links

This Policy does not apply to websites, applications or services operated by third parties, even where they are linked from the Website or integrated with the service — including WhatsApp itself. Their processing of information is governed by their own privacy policies, which you are advised to review.

Changes to This Policy

We may update this Privacy Policy from time to time, including following changes in the Company's activities, the services offered, or legal requirements. The updated version will be published on this page and will take effect on the date of publication, unless otherwise stated. The date of the most recent update appears on this page, and you are advised to review the Policy from time to time.

Contact

For any question, request or report regarding privacy or information security, contact us at chat@weiz.co.il or through the Contact page.